JP6967399B2 - Restoration of headless electronic devices - Google Patents

Description

The present invention relates to a method for restoring an electronic device, and more specifically to a headless electronic device such as a network camera.

Headless electronic devices are electronic devices that have data processing capabilities but do not have a graphical user interface such as a display, and may not have the means to communicate directly with a device such as a keyboard. Examples include network attached storage (NAS), routers, IP cameras, etc., further examples are described in the following specification. Although the present invention will be described primarily in the areas of video monitoring and physical access control, one of ordinary skill in the art will appreciate that the invention can also be used with other headless devices.

Headless devices may be accessed via cable or wireless communication for control and setup purposes. In addition, physical switches are often present to restore headless devices to factory default settings or other predefined restore settings for improved reliability. The physical switch may be a dedicated button, or it may be one or more buttons combined with a specific press pattern, or a magnetic switch accessible with a magnetic key.

Common reasons for initiating a restore are that you have lost your password, or that your headless device settings have fallen into an unfavorable state, such as restore being preferred or restore being the only option through manual reconfiguration. That is.

Headless devices can be electronically protected in the sense that not everyone can connect to the device and change its settings. This can be achieved using the appropriate set of certificates, such as passwords. However, physical restore is a way to avoid such communication in that it is designed to provide a solution in the event that regular communication with the device fails. Therefore, for some headless devices, it is sufficient to physically access the headless device and make it accessible to the factory restore, and the factory restore has started once. Once done, the device can be hijacked by changing its settings, thereby revoking the user-specific password to the default password. Such cancellations are often part of the restore process itself.

Existing solutions to address the above problems include physical locking, as disclosed in US Patent Application No. US2007 / 00714A1 in which the restore button on the router is protected by a lockable cover. The use of physical locks requires the resistance of the device on which the lock is placed, and as a result, it cannot be used in an improveable way for any device, at least not completely. be. This problem is partially circumvented, in particular by the disclosure of US Patent Application No. US2003 / 0005294A1, in which case smart cards and optional pincodes are used to restore or clear protected terminals.

In the worst-case scenario, any individual with physical access to the product will have the opportunity to hijack the headless device and gain access to recorded data (video), configuration changes, and so on. Such scenarios are unlikely, and in particular the rest may need to remain undetected by the system, but improvements would still be worthwhile.

Therefore, in view of the above, an object of the present invention is to provide an improved method and device for restoring a headless electronic device to factory default settings.

According to the first aspect of the present invention, the above object is a method for restoring a setting in a network-connected device.
To receive a start signal indicating a request to restore the settings on the device,
By sending an authentication request over the link-layer protocol, to restore the configuration to the authentication device located as an adjacent node on the network, by sending the authentication request to the received start signal. Requests will be sent accordingly, sending and
Receiving a fully or partially encrypted restore authentication message from an authentication device in response to an authentication request,
Decrypting the received restore authentication message and
Validating the restore authentication message and
Restore When the authentication message is verified, it is realized by a method including restoring the setting on the network-connected device.

The method adds a security feature that ensures that the restore is initiated by an authorized individual, which is especially important as any person will be able to access the networked device from subsequent restores. It is a characteristic. Restore authentication messages could be fully encrypted, but in most cases it would be sufficient to ensure that the message comes from an authenticated source. Next, an alternative to full encryption is to perform partial encryption of the message, for example by adding a digital signature to the message. The benefits and advantages of communication over the link layer protocol, i.e., a method of directly handling a device having an Ethernet address, will be considered in the form for carrying out the invention.

In a further embodiment, the authentication request could be fully or partially encrypted.

In one or more embodiments, the start signal can be triggered by the activation of a restore initiation mechanism located on a networked device, while in other embodiments the start signal is a restore initiation mechanism located on the authentication device. Caused by the activation of. In the actual setup, these possibilities can be combined and the user can choose the solution that is most convenient for them.

In one or several embodiments, the networked device may be arranged to communicate only with a dedicated authentication device. This can be assured by placing a matching certificate or pair of public / private cryptographic keys on each networked and authenticated device. Another option would include a password or identification code that would be entered on the authentication device and sent to the networked device in order to fully authenticate the restore operation. The identification code may be a password or may include a profile identifier that identifies the type of restore operation to be performed.

In one or more embodiments, the method may include accessing the authentication device with an external device. This may be useful when more complex operations are performed, as it will allow the use of more complex user interfaces.

Profile identifiers can also include identifiers for several different networked devices, allowing extended use of a single authentication device.

In any embodiment, the network-attached device is connected to the network via an Ethernet cable and may preferably allow, but not necessarily, power over Ethernet. In addition, the restore operation is to restore the networked device to a restore profile that includes the preset state of the networked device, the preset state shipping from the factory, including restoring the password for accessing the networked device. It may include restoring to a state that has been modified, or that has changed due to a significant software update.

In one or more embodiments, the method may include adding a password that is different from the factory default password. This can be done by using the keypad or user interface of the authentication device, or by having a preset on the networked device. As a result, when the restore process is complete and the networked device is reconnectable, a password different from the default password will be set. Security will be further improved by bridging the time gaps where networked devices can be more vulnerable to unauthenticated access.

According to the second aspect, the present invention relates to an authentication device used in a method for restoring settings on a networked device. The authentication device includes a controller, a non-volatile storage device for software and certificates, a port for Ethernet communication, and optionally a port for power over Ethernet, and communicates with network-attached devices via low-level link-layer packets. It is configured as follows.

In one or more embodiments, the authentication device may include an indicator for displaying the status of the restore process. As an example, the authentication device could indicate successful pairing with a networked device, link contact, PoE negotiations in progress or terminated, and / or the restore process terminated.

In any embodiment, the authentication device may be powered via power over Ethernet or an internal battery. In the case of power over Ethernet power supply, the authentication device may preferably be configured to run power from the power over Ethernet originally located for supply to the networked device.

The authentication device, in one or more embodiments thereof, comprises a restore initiation mechanism, optionally a mechanism that communicates directly with the restore initiation mechanism of the networked device to be restored. Further, the authentication device may include a code input device such as a numerical keypad for inputting an identification code or communicating with the authentication device. The code input device is preferably integrated into the authentication device as part of it.

The authentication device may have multiple Ethernet ports capable of communicating with multiple networked devices.

According to a third aspect, the present invention relates to a system for restoring network-connected device settings, including network-connected devices and any of the aforementioned or later related authentication devices. This embodiment includes several embodiments, for example, the network connection device may be configured to perform the method according to one or any of the disclosed embodiments described above or below.

It should be noted that the present invention relates to all possible combinations of properties unless expressly stated otherwise.

In addition to the above, further objectives, features, and advantages of the present specification will be better understood with reference to the accompanying drawings and through an exemplary, non-limiting, detailed description of preferred embodiments of the invention. However, in this case, the same reference number will be used for similar elements.

It is a schematic diagram of the network connection device in the state where the authentication device is connected to the network connection device. It is a flowchart of the method which shows some embodiments of the method of this invention. It is a schematic plan view of the authentication device by embodiment of this invention. It is a schematic diagram which shows the authentication device by the further embodiment of this invention connected to some network connection devices of the camera form.

FIG. 1 is a schematic diagram of a network device 104, in this particular example, an authentication device 102 connected to a network camera 104. The camera 104 is a headless device in the sense that it has a set of LEDs for which some communication is effective, but does not have a display for communication with the operator.

The camera 104 is connected to Ethernet via an Ethernet cable 106, preferably providing Power over Ethernet (PoE), and only a single connector is available on the camera 104. The direct advantage of using PoE is that the Ethernet cable 106 transfers power and allows the transfer of information to and from the camera, so that only a single network cable needs to be provided in the installation. There is. The real advantage is that the power to the product when referring to PoE is not considered high voltage, so high voltage regulations do not apply and untrained personnel may operate and install the equipment. Will.

The setup shown in FIG. 1 also includes an authentication device 102 connected in series with a camera 106 immediately upstream thereof. A valid Ethernet cable lead 106 is not connected to the camera, but instead is connected to the authentication device 102, and additional cables defined by 106'are also connected here to the authentication device 102 and the camera 104. Has been done.

When PoE is used, the authentication device 102 bypasses power, preferably via an Ethernet cable, and transfers data to and from camera 104 so that power is maintained to camera 104. Can be maintained. In one or some embodiments, data transfer to and from network-attached devices via the authentication device is blocked during the restore process, such as to prevent unauthorized access immediately after performing the restore. ..

The authentication device 102 taps power from the Ethernet cable 106 for its own function, but may also have a separate power source and may be provided with an internal power source such as a battery. Tapping power from the Ethernet cable has the advantage that the components contained in the authentication device can be kept to a minimum. Using an inner battery or another power source could also have some advantages. One advantage is that use will not be limited to PoE powered devices. In such an embodiment, the authentication device would only require an Ethernet connection to connect to a networked device, rather than a currency port.

In another embodiment where the camera is powered by an external source other than PoE, the authentication device is via the camera, for example, from the camera 104 to the authentication device 102 via an Ethernet cable 106'or via a separate connection. Can be powered. An alternative way to connect an authentication device to a camera via Ethernet or an Ethernet cable would be to use wireless communication. Such an approach can be advantageous from a flexible point of view, as access can be provided without a physical connection to the camera. However, this can also be considered a weakness from a security standpoint.

Returning to FIG. 1, the camera 104 is provided with a restore button 108. In this context, it is important to recognize that the restore button 108 represents a function rather than a physical button. The restore button may actually be a dedicated restore button 108, but may be one or more generic buttons that initiate a restore when pressed according to a particular sequence. In other embodiments, the restore button may be actuated magnetically or electronically, providing an advantage in that the button is concealed within the camera housing and provides some protection from the environment and unintended operation. In one or more embodiments, although not shown, restore functionality is initiated using Near Field Communication (NFC), in which the camera is provided with a means of communication using the NFC protocol. Will have to be done.

The camera is provided with factory-restore functionality, allowing the camera to be restored to its factory-shipped state, eg, to the state corresponding to the settings recommended by the camera manufacturer. In the real world, the main reason the user initiates the restore operation is that the password was incorrect or missing, or the network settings were set to a non-functional value. In the absence of these issues, accessing the camera via the network and user interface is often considered more convenient. There can be several levels of restore, but in general the restore operation will result in all user settings being erased and replaced by factory settings. Some parameters, such as statistical logs, that have been updated since the camera was shipped from the factory can be maintained in that state in order to maintain service intervals. Further, the settings corresponding to the restored state may be changed, for example, by updating the firmware of the network device 104, thereby establishing a new factory default state.

The authentication device 102 is provided with a processing unit such as a microprocessor or microcontroller 110 and is a storage unit for a non-volatile storage device such as a password, a certificate, and optionally one or several restore profiles or restore profile identifiers. It enables communication with 112 and its processing.

FIG. 2 shows a functional flow chart for a method according to one embodiment and may be considered with FIG. 1 for further understanding. According to the method, the restoration operation is started by the operation of the restoration button (some button) 216. The purpose of initiating the restore operation is to be authenticated by communication between the camera and the authentication device 218. According to this embodiment, the previously installed certificate is available on the camera, whereas another part of the certificate is located inside the authentication device, which is generally where the private key is located on the authentication device. Regarding the asymmetric cryptographic process, where the corresponding public key of the key pair is placed on the camera.

In this embodiment or another embodiment, the start signal and subsequent request may include sending a challenge from the camera to the authentication device. The challenge can be an encrypted salted truth. The authentication device then provides a response in line with the challenge by decrypting the challenge with the private key, encrypting the salt-type truth with the private key, and returning it to the camera. The response is therefore preferably digitally signed or encrypted, allowing the camera to infer that the response was provided (at a particular time) by a particularly or at least verified authentication device, which is which. It will be the purpose regardless of whether the technology is used. This basically follows standard challenge / response authentication. Thus, replay attacks, i.e., the use of old communication between the camera and the authentication device for suspicious purposes, can be blocked. In situations where the challenge or request sent by the camera contains information to be protected, they can be encrypted. As shown in connection with FIG. 1, the authentication device 102 is located immediately upstream of the camera 104 in the sense that no switch or router is located between the authentication device 102 and the camera 104. The camera will communicate with the authentication device via the link layer protocol, so it is possible to verify that the authentication device is located directly near the network of the camera, i.e. in the same network segment. be. It is possible to communicate via a touch panel and a cable that can simplify the actual use of the present invention. Communication will remain within the network segment because these types of low-level network packets are not routed. This technique will provide an additional level of security in that the operator needs to access not only the right hardware but also the right location to initiate the restore operation. A further real benefit of using communication over the link layer is that the network parameters are set to inoperable and cannot communicate with high level protocols. High-level protocols require so-called Ethernet addresses, but the device may not be configured correctly, so Ethernet addresses do not work properly or are simply unknown. For example, communication at the link layer using so-called MAC addresses, which is used locally within one network segment, always ensures that direct communication with the device is possible separately from the device configuration. become.

If the restore start is verified as described above, the camera restore will be performed 222. The restoration in this embodiment or any embodiment can be a factory restoration or a restoration to any other preset restoration profile as discussed above.

Several different events can be triggered if the certificate or password does not match, or if the authentication device is not detected. If the restore button works incorrectly, especially if the same button is also used to activate other functions, the next best action would be to ignore the restore request 224 and not accept the action at all. Let's do it. In another embodiment, the restore request adds a ignored 224 to the system log and / or generates a flag, event, or alarm 226 to inform the operator of possible tampering with the network device. This is shown inside the dotted rectangle in FIG.

To summarize the behavior of the authentication device in one or more basic embodiments, the authentication device will receive an authentication request and decrypt it if necessary. Following validation of the request, an authentication response is created, encrypted, and sent to the networked device.

Following the restore, the authentication device may be disconnected and the Ethernet cable may be reconnected to the networked device, or the authentication device may optionally remain connected. After a successful restore, any certificate will be removed from the product, but if the restore profile containing the new system password and / or certificate is not used, all other such as IP settings and system passwords. Must be reinstalled with certain system settings.

FIG. 3 is a schematic plan view of the authentication device 302 according to one embodiment and, in practice, shows any number of possible properties that can be combined to form a variety of different embodiments. The authentication device 302 includes a keypad 328, enabling password protection functionality. At least two different functions can be emphasized in this context. First, access to the actual authentication device can be protected by a pin code or something similar, which can only be used by an authenticated person. Second, the pin code can be included in the response to the camera and will not be restored if the code is unknown. These two can, of course, be used separately or in combination. Keybuds can also be used to communicate with authentication devices, including specific restore profiles, pin code entry, and so on. A particular restore profile may refer to an individual profile for a particular networked device. A particular network-attached device may have several restore profiles associated with it. That is, one factory restore is implicitly the default restore, and many other restore profiles are based on user-defined or pre-installed settings. In one or more embodiments, the restore to a profile different from the default profile includes the initial restore to the default profile followed by the automatic setting of parameters resulting in a user-defined profile or a tailor-created profile.

The default profile may be updated over time in one or any embodiment. An example could include a default profile that corresponds to the state in which the camera is shipped from the factory. This will be the default profile until the manufacturer provides a software release, after which the software release or at least its related parts will update the default profile.

The default profile is preferably stored in the camera, and any other profile can be stored in the camera as well, but this is used (or restored) by the authentication device rather than the entire profile. It means that you only need to communicate with the profile to (just check if it should be).

The authentication device may include an indicator light 330, such as an LED, to indicate various operating conditions. One example could be a stable light (green) signaling a matching certificate, or a pulsed (green) light indicating that processing is in progress. Further indications could be one or more signals confirming that the camera has successfully passed the factory defaults, has been properly restarted, and has additions to the default profile installed.

The button 332 of the authentication device can be used to verify the restore in that the restore initiation requires the activation of the button 332 for the restore to continue. With respect to the restore button considered in the connection to the camera, the restore button 332 has a different shape or form and the same example applies. The button 332 or corresponding functionality in the authentication device may also be configured to generate a start signal to initiate the restore process. One advantage of having such an arrangement is that the operator does not need direct access to the camera. Surveillance cameras are often located at the top of posts, above highways, under bridges, above railroads, stairs, and other places that are difficult to access. In such embodiments, the buttons on the authentication device are wired or programmed to play the role of camera restore functionality, but may also generate a first signal to be transmitted to the camera. , The first signal will trigger the start of the restoration process.

Further characteristics of the authentication devices 102, 302 have been investigated with reference to FIG.

FIG. 4 shows an authentication device according to a further embodiment of the present invention. In an exemplary embodiment, the most notable difference is that the authentication device 402 allows output to several cameras, i.e., it comprises a plurality of connectors of the same type as those described in connection with the previous embodiment. As a result, it results in any number of channels available for connecting connected devices. In the illustrated embodiment, there are three such channels, but the number of channels may actually be less or more. When the restoration of the cameras 404, 404 ′, 404 ″ is started, the function of the authentication device 402 will also be the same as that already described in connection with the above-described embodiment. The operator communicates through the user interface, which may correspond to similar things for verifying the restore process when pincode typing, button operation, or verification is requested. In an embodiment, each channel of the authentication device is associated with an LED light, an initialization request from the camera results in a signal display from the corresponding LED light, after which the user presses a button on the authentication device. , The request can be validated. Also, there may be one such button for each channel.

In an alternative embodiment, the user interface is realized via an auxiliary device 434 connected to the authentication device 402. The auxiliary device can be a portable computer, tablet, or another portable device.

Throughout the detailed description, an example of a given network-attached device was just a camera. This should not be construed as limiting the invention. The properties that characterize the camera are not essential to the functionality of the invention, and the term "camera" does not deviate from the scope of the invention and is arbitrary, including examples already provided as well as similar devices. It is easily understood that it may be replaced by other headless devices. Examples are physical access controllers, network door stations, network card readers, network I / O relay modules, video encoders, routers, switches, network mounted storage units, personnel detectors, object detectors, smoke detectors, networked Includes various network object units such as thermostats, lamps, environment sensors, presence detectors, actuators, household appliances, microphones, loudspeakers, health monitors, ie, basically Ethernet connection and restore buttons. Includes any headless device such that the activation of the restore button resets the password to factory defaults.

Those skilled in the art will appreciate that the above embodiments have been modified in many ways and that the advantages of the invention shown in the above embodiments are still available. Therefore, the invention should not be limited to the illustrated embodiments, but should be defined only by the appended claims. Further, as those skilled in the art understand, the illustrated embodiments may be combined.

Claims (14)

A way to restore settings on networked devices,
Connecting the authentication device to the network connection device as an adjacent node on the network,
Receiving a start signal indicating a request to restore the settings on the networked device, and
Sending a fully or partially encrypted authentication request from a networked device to restore the configuration to the authentication device by sending the authentication request over the link layer protocol. The request is transmitted, transmitted, and the like in response to the received start signal.
With the network connection device
Receiving a fully or partially encrypted restore authentication message from the authentication device in response to the authentication request.
Decoding the received restoration authentication message and
Verifying the restore authentication message and
A method comprising restoring the settings on the network-attached device when the restore authentication message is validated. The method of claim 1, wherein the start signal is triggered by the activation of a restore start mechanism located in the network-connected device. The method of claim 1 or 2, wherein the start signal is triggered by the activation of a restore start mechanism located in the authentication device. The method according to any one of claims 1 to 3, wherein the network connection device is arranged so as to communicate only with a dedicated authentication device. The method according to any one of claims 1 to 4, wherein the restoration authentication message includes an identification code input by the authentication device. From claim 1, further comprising placing a set of restore profile identifiers on the authentication device, which allows restoration to several different restore states and / or restoration of several different networked devices. The method according to any one of 5. The method according to any one of claims 1 to 6, wherein the restoration authentication message is digitally signed. To restore the settings, the network connection device, the method comprising recover to a recovered profile comprising predetermined state with respect to the network connection device, a state where the preset is shipped from the factory corresponding to state, the method according to any one of claims 1 to 7. An authentication device used in the method of claim 1 for restoring settings on a networked device.
With the controller
Non-volatile storage for software and certificates,
It has a port for Ethernet communication with the network connection device.
An authentication device configured for communication with network-attached devices over low-level link-layer packets. The authentication device of claim 9, further comprising an indicator for displaying the status of the restore process. Comprising a restore initiation Organization, the authentication device according to claim 9 or 10. The authentication device according to any one of claims 9 to 11, further comprising a code input device. Further comprising a passage port for Ethernet communications, the authentication device according to any one of claims 9 to 12. A network connection device comprising a network connection device configured to perform the method according to any one of claims 1 to 8 and a related authentication device according to any one of claims 9 to 13. A system for restoring the settings of.

Images